Can we Identify individual user in Cognito user pool for accessing api gateway via client credential auth method?

Question

Currently we are using client credential to get an auth token from aws cognito through which a client can access our api configured in api gateway. Now we need to restrict access to some resources in api gateway for specific users. How can we achieve this in cognito without using user login or third party auth?

Answer 1

Cognito token is a JWT token which can be decoded using available libraries like https://jwt.io/

The decoded output would be something like below

For your use case you can put a custom authorizer on API Gateway which decodes the JWT token and based on "cognito:username" it can allow or restrict access